EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

How to fix it

Set at creation: fixing it means replacing the resource.

Enable encryption on every EBS volume the fleet's launch parameters define. A Spot Fleet request's launch specifications cannot be modified, so this means cancelling the request and submitting a new one, and the instances it is running are replaced rather than converted. Turning on account-level EBS default encryption, which is EC2.7, is the less disruptive fix and covers new volumes without touching the fleet at all.

In the console

EC2 → Spot Requests → Request Spot Instances → Additional launch parameters → Storage (volumes) → Encrypted

With Terraform

resource "aws_spot_fleet_request" "this" {
  iam_fleet_role  = var.fleet_role_arn
  target_capacity = 2
  launch_specification {
    ami           = var.ami_id
    instance_type = "m5.large"
    root_block_device {
      encrypted = true
    }
  }
}